PT-2026-141010

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint decode function because cook decode init does not check js subband start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode buffer 0, leaking pointers...